CVE-2026-15379: Arbitrary File Read as SYSTEM in Symantec ITMS
The Altiris WMI provider exposes a class (AltirisAgentStream) that allows any local standard user to read the contents of any file accessible to the SYSTEM account, bypassing filesystem ACLs. No admin privileges required. The provider reverts to the LocalSystem context when servicing WMI queries without re-impersonating the caller. Any local standard user can therefore read SYSTEM-readable files — including configuration files, service logs, and secrets stored with SYSTEM/Administrator-only ACLs — by querying the provider directly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to WMI (including the Altiris WMI provider class AltirisAgent_Stream) so only authorized administrators can query it; prevent local standard users from issuing WMI queries that allow arbitrary file reads as the SYSTEM/LocalSystem context.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15379?
CVE-2026-15379 has a medium severity rating of 5.1.
How do I fix CVE-2026-15379?
To address CVE-2026-15379, update to the latest version of Broadcom Symantec ITMS as per vendor guidance.
What type of vulnerability is CVE-2026-15379?
CVE-2026-15379 is an arbitrary file read vulnerability that allows unauthorized access to files accessible by the SYSTEM account.
Who is affected by CVE-2026-15379?
Any local standard user with access to the affected Altiris WMI provider in Broadcom Symantec ITMS is vulnerable to CVE-2026-15379.
What are the potential impacts of CVE-2026-15379?
CVE-2026-15379 could lead to unauthorized information disclosure by allowing local users to read sensitive files.